A significant aspect of operating a plurality of data processors in a multiprocessor system complex is the synchronization of the individual clocks associated therewith. For example, it is desirable and in fact, frequently necessary that the separate Time of Day (TOD) clocks of the coupled processors be synchronized if these processors are sharing Direct Access Storage Devices (DASD), the data contained upon DASD and other resources, or the processors are exchanging messages. Concomitant with the need for synchronization is that the synchronizing mechanism be fault tolerant. That is, single points of failure in the mechanism itself should be tolerated, such that loss of synchronization in the entire system complex will not occur.
Considerable effort has been directed by the computer industry to the design of fault-tolerant clock systems. Many of these designs have relied upon primary/secondary configurations of clocks. These systems typically have difficulty in detecting failures on the primary and when problems are detected they cannot easily switch from the primary to the secondary. Attempts to address these problems have been both expensive and unsatisfactory. The root cause of these problems is that the required resolution of the clock is typically smaller than the skew between the primary and secondary clock.
What is needed is an economical hardware means for providing synchronized operation of arbitrarily high separate resolution TOD clocks in the processors in a system complex. Moreover, since the complex represents a valuable resource and the individual processors exhibit intrinsic isolation of failures to single machines, it is necessary that the chosen clock synchronization mechanism not behave as a coupled or common failure mechanism, whereby a single point of failure therein could bring the entire complex down. The synchronization mechanism of the present invention fills such a need.